[split-required] Split final 43 files (500-668 LOC) to complete refactoring

klausur-service (11 files):
- cv_gutter_repair, ocr_pipeline_regression, upload_api
- ocr_pipeline_sessions, smart_spell, nru_worksheet_generator
- ocr_pipeline_overlays, mail/aggregator, zeugnis_api
- cv_syllable_detect, self_rag

backend-lehrer (17 files):
- classroom_engine/suggestions, generators/quiz_generator
- worksheets_api, llm_gateway/comparison, state_engine_api
- classroom/models (→ 4 submodules), services/file_processor
- alerts_agent/api/wizard+digests+routes, content_generators/pdf
- classroom/routes/sessions, llm_gateway/inference
- classroom_engine/analytics, auth/keycloak_auth
- alerts_agent/processing/rule_engine, ai_processor/print_versions

agent-core (5 files):
- brain/memory_store, brain/knowledge_graph, brain/context_manager
- orchestrator/supervisor, sessions/session_manager

admin-lehrer (5 components):
- GridOverlay, StepGridReview, DevOpsPipelineSidebar
- DataFlowDiagram, sbom/wizard/page

website (2 files):
- DependencyMap, lehrer/abitur-archiv

Other: nibis_ingestion, grid_detection_service, export-doclayout-onnx

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

backend-lehrer/auth/__init__.py

@@ -4,15 +4,11 @@ BreakPilot Authentication Module
 Hybrid authentication supporting both Keycloak and local JWT tokens.
 """
 
-from .keycloak_auth import (
+from .keycloak_models import (
     # Config
     KeycloakConfig,
     KeycloakUser,
 
-    # Authenticators
-    KeycloakAuthenticator,
-    HybridAuthenticator,
-
     # Exceptions
     KeycloakAuthError,
     TokenExpiredError,
@@ -21,6 +17,14 @@ from .keycloak_auth import (
 
     # Factory functions
     get_keycloak_config_from_env,
+)
+
+from .keycloak_auth import (
+    # Authenticators
+    KeycloakAuthenticator,
+    HybridAuthenticator,
+
+    # Factory functions
     get_authenticator,
     get_auth,